Privacy Notice

/Privacy Notice
Privacy Notice 2018-05-23T10:59:48+00:00

Your Personal Data – what is it?

Personal data is any information about a living individual which allows them to be identified from that data alone or by combining it with other information.
The processing of personal data is governed by the General Data Protection Regulation – effective 25th May 2018.

Data Controller

This Privacy Notice is provided to you by Elvetham Heath Parish Council which is the data controller for your data. This means it decides how your data is processed and for what purpose.

This Parish Council takes the protection of your data seriously. Our aim is to provide a personal and valuable service whilst safeguarding your privacy. Collecting some personal information is necessary to satisfy the expectations and requirements of our residents and customers and we have set out in this notice what we will do with your personal information.

Principles of GDPR

Elvetham Heath Parish Council complies with the 6 principles of GDPR when handling personal data as follows:

  • It is processed lawfully, fairly and transparently.
  • It is only used for the specific purpose of which you are aware and not further processed without your permission
  • It is relevant and limited to what is necessary for the specified purpose.
  • It is accurate and, where necessary, kept up to date.
  • It is only kept for as long as is necessary for that purpose and that storage is safe and secure.
  • It is kept and subsequently destroyed securely; and measures are in place to protect it from loss, misuse, unauthorised access and disclosure.

Personal Data we process

The Council will process some or all of the following where necessary to perform its task:

  • Names, titles and aliases, photographs & images;
  • Contact details such as telephone numbers, addresses and email addresses;
  • Where you pay for activities such as use of council facilities, financial identifiers such as bank account numbers, payment identifiers, policy & claim numbers.

The Council does not collect ‘sensitive personal data’ as defined under GDPR which includes data relating to racial of ethnic origin, political opinions, religious beliefs, criminal convictions, physical & mental health & sexual orientation. It may, however, process this data in relation to employment which is subject to a separate privacy notice.

How we use your personal data?

The Parish Council processes your data for some of the following purposes:

  • To deliver public services and maintain our facilities;
  • To confirm your identity to provide some services;
  • To contact you by post, email, telephone or social media;
  • To maintain our own records and accounts;
  • To ensure the proper use of public funds;
  • To enable us to meet all our legal and statutory obligations and powers including any delegated functions;
  • To manage our employees and volunteers;
  • To inform you of news, events & activities within the parish.

The Legal Basis for processing your personal data

The council processes personal data under 3 legal bases:

  • As a public authority the council has certain powers and obligations. Most of your personal data is processed for compliance with legal obligations which includes carrying out the council’s statutory functions and powers.
  • Contractual relationship: we may process personal data if it is necessary for the performance of a contract with you eg. Hiring our facilities or an allotment tenancy agreement.
  • Consent: sometimes the use of your personal data requires your express consent and we will not use it until that consent has been granted.

Sharing your personal data

Your personal data will be treated as strictly confidential. We will only share your data with third parties with your consent unless it is for the purposes of criminal investigation or proceedings.

It should be noted that we receive some personal data from other data controllers, eg. The electoral roll & planning applications. We will process that data in accordance with our policy.

How long do we keep your personal data?

We will only retain personal data for as long as is deemed necessary. We are legally obliged to keep some records permanently and financial records for 7 years for tax purposes.
Details of our data retention periods can be found in our Record Retention Policy and our Data Protection Policy.
When personal data is no longer needed it will be destroyed or deleted in a secure manner.

Your rights and your personal data

Under GDPR you have the following rights with respect to your personal data:

Please note: when exercising any of the rights listed below, we may require you to verify your identity for security purposes. In such cases we will need you to prove your identity before you can exercise these rights.

  • The right to access personal data we hold on you
    • At any point you can contact us to request a copy of the personal data Elvetham Heath Parish Council holds on you. Once we have received your request we will respond within one month.
    • There are no fees or charges for the request although unfounded or excessive requests may be subject to an administrative fee.
  • The right to correct and update the personal data we hold on you
    • If the data we hold on you is out of date, incomplete or incorrect, you can inform us and your data will be updated.
  • The right to have your personal data erased
    • If you feel that we should no longer be using your personal data or that we are unlawfully using it, you can request that we erase the personal data we hold
    • When we receive your request, we will confirm whether the personal data has been deleted or give a reason why it cannot be destroyed.
  • The right to object to processing of your personal data or to restrict it use
    • You have the right to request that we stop processing your personal data or ask us to restrict processing.
    • Upon receipt of your request we will confirm whether we are able to comply or if we have a legal obligation to continue to process your data.
  • The right to data portability
    • You have the right to request that we transfer some of your data to another controller.
    • We will comply with your request within one month, where it is feasible to do so.
  • The right to withdraw your consent at any time to the processing of your data
    • You can withdraw the consent you previously gave us by contacting the office by telephone, email or by post (contact details below).
  • The right to lodge a complaint with the Information Commissioner’s Office
    • You can contact the Information Commissioner’s Office on 0303 123 1113 or via its website email service https://ico.org.uk/global/contact-us/email/ or by post to information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Transfer of Data Abroad

All personal data will be placed on systems within the UK or European Economic Area.
However, it should be noted that our website is accessible from overseas so on some occasions personal data may be accessed abroad.

Further Processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a separate notice explaining this new use prior to commencing the processing. Where and whenever necessary, we will seek your prior consent to the new processing.

Contact Details

To exercise all relevant rights or if you have any questions about this Privacy Notice, please contact
The Data Controller at
Elvetham Heath Parish Council
The Key Centre
Elvetham Heath
Fleet GU51 1HA
Email: office@elvethamheath-pc.org.uk
The Data Protection Officer who monitors our compliance is Mr Kevin Rose of IAC Ltd
admin@audit-iac.com

Changes to this notice

We keep this Privacy Notice under regular review and will place any updates on this web page.

Last update April 2018